OpenVPN suddenly unreliable when connecting

xmteam

I used to have my VPN running perfectly along with forwarding all traffic through it, however, now it can't even ping 10.8.0.1 (the server) successfully when it manages to connect. Often it doesn't even connect and just stops at the "TLS key negotiation failed" message before attempting to connect. The client is running Windows 8 and the server is running Ubuntu 12.04. Any ideas on what might be causing this sudden unreliability?

maikcat

TLS errors usually comes from:

firewall blocking traffic along the way

routers with poor NAT implementation...

check your firewalls (router.openvpn server itself),

if you use a cheap DSL router simply reboot it...

Michael.

xmteam

It's on a VPS, so I don't think it's using a cheap DLS router, and I don't think that there are any firewall errors seeing as it was running perfectly before, and I can access my website fine if I run an https server (I'm using port 443 on TCP for my VPN). Are there any log files that might be useful?

maikcat

use verb 5 and post server logs....

no one can connect to your server or only the client with win 8?

Michael.

xmteam

All clients sometimes can connect to the server, however, the Internet isn't forwarded and pinging 10.8.0.1 fails most of the time, or gives a huge latency (e.g. 3052ms). Assuming openvpn-status.log is the right log it only showed this (I made sure to restart after enabling verb 5, and I made two "successful" and one failed connection), this is all it has:

OpenVPN CLIENT LIST
Updated,Tue Feb 12 20:41:01 2013
Common Name,Real Address,Bytes Received,Bytes Sent,C$UNDEF,81.105.181.20:21780,1872,5122,Tue Feb 12 20:40$ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
END

maikcat

please add to your server conf this:

log openvpn.log

restart service try to connect then post the contents of openvpn.log

Michael.

xmteam

Here's the log:

Wed Feb 13 19:13:43 2013 us=899411 OpenVPN 2.3.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jan  8 2013
Wed Feb 13 19:13:43 2013 us=899753 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb 13 19:13:43 2013 us=901677 Diffie-Hellman initialized with 1024 bit key
Wed Feb 13 19:13:43 2013 us=902099 TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Feb 13 19:13:43 2013 us=902141 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Feb 13 19:13:43 2013 us=902836 TUN/TAP device tun0 opened
Wed Feb 13 19:13:43 2013 us=902860 TUN/TAP TX queue length set to 100
Wed Feb 13 19:13:43 2013 us=902882 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 13 19:13:43 2013 us=902915 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Feb 13 19:13:43 2013 us=905659 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Feb 13 19:13:43 2013 us=907581 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 13 19:13:43 2013 us=908149 Listening for incoming TCP connection on [undef]
Wed Feb 13 19:13:43 2013 us=908222 TCPv4_SERVER link local (bound): [undef]
Wed Feb 13 19:13:43 2013 us=908241 TCPv4_SERVER link remote: [undef]
Wed Feb 13 19:13:43 2013 us=908264 MULTI: multi_init called, r=256 v=256
Wed Feb 13 19:13:43 2013 us=908380 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Feb 13 19:13:43 2013 us=908411 ifconfig_pool_read(), in='client,10.8.0.4', TODO: IPv6
Wed Feb 13 19:13:43 2013 us=908434 succeeded -> ifconfig_pool_set()
Wed Feb 13 19:13:43 2013 us=908444 IFCONFIG POOL LIST
Wed Feb 13 19:13:43 2013 us=908452 client,10.8.0.4
Wed Feb 13 19:13:43 2013 us=908482 MULTI: TCP INIT maxclients=1024 maxevents=1028
Wed Feb 13 19:13:43 2013 us=908529 Initialization Sequence Completed
Wed Feb 13 19:15:06 2013 us=745862 MULTI: multi_create_instance called
Wed Feb 13 19:15:06 2013 us=745956 Re-using SSL/TLS context
Wed Feb 13 19:15:06 2013 us=746004 LZO compression initialized
Wed Feb 13 19:15:06 2013 us=746286 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Feb 13 19:15:06 2013 us=746339 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 13 19:15:06 2013 us=746397 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 13 19:15:06 2013 us=746410 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 13 19:15:06 2013 us=746447 Local Options hash (VER=V4): 'c0103fa8'
Wed Feb 13 19:15:06 2013 us=746468 Expected Remote Options hash (VER=V4): '69109d17'
Wed Feb 13 19:15:06 2013 us=746505 TCP connection established with [AF_INET]<IP ADDRESS>:27316
Wed Feb 13 19:15:06 2013 us=746521 TCPv4_SERVER link local: [undef]
Wed Feb 13 19:15:06 2013 us=746538 TCPv4_SERVER link remote: [AF_INET]<IP ADDRESS>:27316
RWed Feb 13 19:15:08 2013 us=747729 <IP ADDRESS>:27316 TLS: Initial packet from [AF_INET]<IP ADDRESS>:27316, sid=4496ce0c 805d3312
WRWWRWWRWWed Feb 13 19:15:30 2013 us=74836 <IP ADDRESS>:27316 Connection reset, restarting [-1]
Wed Feb 13 19:15:30 2013 us=74899 <IP ADDRESS>:27316 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Feb 13 19:15:30 2013 us=75042 TCP/UDP: Closing socket
Wed Feb 13 19:15:38 2013 us=565827 MULTI: multi_create_instance called
Wed Feb 13 19:15:38 2013 us=565933 Re-using SSL/TLS context
Wed Feb 13 19:15:38 2013 us=566000 LZO compression initialized
Wed Feb 13 19:15:38 2013 us=566145 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Feb 13 19:15:38 2013 us=566187 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 13 19:15:38 2013 us=566251 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 13 19:15:38 2013 us=566274 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 13 19:15:38 2013 us=566330 Local Options hash (VER=V4): 'c0103fa8'
Wed Feb 13 19:15:38 2013 us=566367 Expected Remote Options hash (VER=V4): '69109d17'
Wed Feb 13 19:15:38 2013 us=566414 TCP connection established with [AF_INET]<IP ADDRESS>:28393
Wed Feb 13 19:15:38 2013 us=566442 TCPv4_SERVER link local: [undef]
Wed Feb 13 19:15:38 2013 us=566465 TCPv4_SERVER link remote: [AF_INET]<IP ADDRESS>:28393
RWed Feb 13 19:15:40 2013 us=561816 <IP ADDRESS>:28393 TLS: Initial packet from [AF_INET]<IP ADDRESS>:28393, sid=e9198086 fe394eff
WWRWWRWWRWWed Feb 13 19:15:59 2013 us=503386 <IP ADDRESS>:28393 Connection reset, restarting [-1]
Wed Feb 13 19:15:59 2013 us=503434 <IP ADDRESS>:28393 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Feb 13 19:15:59 2013 us=503515 TCP/UDP: Closing socket
Wed Feb 13 19:16:08 2013 us=12275 MULTI: multi_create_instance called
Wed Feb 13 19:16:08 2013 us=12345 Re-using SSL/TLS context
Wed Feb 13 19:16:08 2013 us=12359 LZO compression initialized
Wed Feb 13 19:16:08 2013 us=12431 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Feb 13 19:16:08 2013 us=12453 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 13 19:16:08 2013 us=12498 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 13 19:16:08 2013 us=12511 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 13 19:16:08 2013 us=12533 Local Options hash (VER=V4): 'c0103fa8'
Wed Feb 13 19:16:08 2013 us=12552 Expected Remote Options hash (VER=V4): '69109d17'
Wed Feb 13 19:16:08 2013 us=12578 TCP connection established with [AF_INET]<IP ADDRESS>:29436
Wed Feb 13 19:16:08 2013 us=12588 TCPv4_SERVER link local: [undef]
Wed Feb 13 19:16:08 2013 us=12595 TCPv4_SERVER link remote: [AF_INET]<IP ADDRESS>:29436
RWed Feb 13 19:16:10 2013 us=5297 <IP ADDRESS>:29436 TLS: Initial packet from [AF_INET]<IP ADDRESS>:29436, sid=d3d8167b 338b7a40
WWRWRWRRWRWRWWWWRWRWRWWWRWRRWWRWWWRWWRWRWRWRWWWWWWRWRWRWWRWWWRWRWWWWWWWWWWWRRWWWWed Feb 13 19:17:08 2013 us=455682 <IP ADDRESS>:29436 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Feb 13 19:17:08 2013 us=455738 <IP ADDRESS>:29436 TLS Error: TLS handshake failed
Wed Feb 13 19:17:08 2013 us=455846 <IP ADDRESS>:29436 Fatal TLS error (check_tls_errors_co), restarting
Wed Feb 13 19:17:08 2013 us=455870 <IP ADDRESS>:29436 SIGUSR1[soft,tls-error] received, client-instance restarting
Wed Feb 13 19:17:08 2013 us=455912 TCP/UDP: Closing socket
Wed Feb 13 19:17:18 2013 us=951250 MULTI: multi_create_instance called
Wed Feb 13 19:17:18 2013 us=951335 Re-using SSL/TLS context
Wed Feb 13 19:17:18 2013 us=951355 LZO compression initialized
Wed Feb 13 19:17:18 2013 us=951444 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Feb 13 19:17:18 2013 us=951462 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 13 19:17:18 2013 us=951491 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 13 19:17:18 2013 us=951504 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 13 19:17:18 2013 us=951528 Local Options hash (VER=V4): 'c0103fa8'
Wed Feb 13 19:17:18 2013 us=951551 Expected Remote Options hash (VER=V4): '69109d17'
Wed Feb 13 19:17:18 2013 us=951594 TCP connection established with [AF_INET]<IP ADDRESS>:31890
Wed Feb 13 19:17:18 2013 us=951606 TCPv4_SERVER link local: [undef]
Wed Feb 13 19:17:18 2013 us=951617 TCPv4_SERVER link remote: [AF_INET]<IP ADDRESS>:31890
RWed Feb 13 19:17:20 2013 us=949220 <IP ADDRESS>:31890 TLS: Initial packet from [AF_INET]<IP ADDRESS>:31890, sid=36ec58b8 fd7e89cf
WWRWWRRWRWRWWWWRRRWRWWWWWRWRWWWRRWWRWWWRRWRWRWRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWed Feb 13 19:17:56 2013 us=11761 <IP ADDRESS>:31890 VERIFY OK: depth=1, C=GB, CN=CA, name=CA
Wed Feb 13 19:17:56 2013 us=11922 <IP ADDRESS>:31890 VERIFY OK: depth=0, C=GB, CN=client
WRWRWRWRWRWRWRWRWRWRWRWRWWWWWRWRWRWWRWWWRWWRWWRWRWRWWed Feb 13 19:18:18 2013 us=1640 <IP ADDRESS>:31890 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Feb 13 19:18:18 2013 us=1698 <IP ADDRESS>:31890 TLS Error: TLS handshake failed
Wed Feb 13 19:18:18 2013 us=1871 <IP ADDRESS>:31890 Fatal TLS error (check_tls_errors_co), restarting
Wed Feb 13 19:18:18 2013 us=1896 <IP ADDRESS>:31890 SIGUSR1[soft,tls-error] received, client-instance restarting
Wed Feb 13 19:18:18 2013 us=1959 TCP/UDP: Closing socket
Wed Feb 13 19:18:29 2013 us=760702 MULTI: multi_create_instance called
Wed Feb 13 19:18:29 2013 us=760783 Re-using SSL/TLS context
Wed Feb 13 19:18:29 2013 us=760798 LZO compression initialized
Wed Feb 13 19:18:29 2013 us=760916 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Feb 13 19:18:29 2013 us=760943 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 13 19:18:29 2013 us=761006 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 13 19:18:29 2013 us=761025 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 13 19:18:29 2013 us=761045 Local Options hash (VER=V4): 'c0103fa8'
Wed Feb 13 19:18:29 2013 us=761056 Expected Remote Options hash (VER=V4): '69109d17'
Wed Feb 13 19:18:29 2013 us=761081 TCP connection established with [AF_INET]<IP ADDRESS>:34008
Wed Feb 13 19:18:29 2013 us=761092 TCPv4_SERVER link local: [undef]
Wed Feb 13 19:18:29 2013 us=761105 TCPv4_SERVER link remote: [AF_INET]<IP ADDRESS>:34008
RWed Feb 13 19:18:31 2013 us=760852 <IP ADDRESS>:34008 TLS: Initial packet from [AF_INET]<IP ADDRESS>:34008, sid=30e0769f f80df1fc
WRWRRWRWRWWWWRWWRWRWRWWRWRWWWRRWWWRWRWWWWWWWRWRWWWRWRWWWWWRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWed Feb 13 19:19:01 2013 us=381928 <IP ADDRESS>:34008 VERIFY OK: depth=1, C=GB, CN=CA, name=CA
Wed Feb 13 19:19:01 2013 us=382075 <IP ADDRESS>:34008 VERIFY OK: depth=0, C=GB, CN=client
WRWRWRWRWRWWWWRWRWWWWWRWRWRWRWRWRWed Feb 13 19:19:11 2013 us=544030 <IP ADDRESS>:34008 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 13 19:19:11 2013 us=544065 <IP ADDRESS>:34008 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 13 19:19:11 2013 us=544124 <IP ADDRESS>:34008 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 13 19:19:11 2013 us=544143 <IP ADDRESS>:34008 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRWed Feb 13 19:19:13 2013 us=558422 <IP ADDRESS>:34008 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Feb 13 19:19:13 2013 us=558493 <IP ADDRESS>:34008 [client] Peer Connection Initiated with [AF_INET]<IP ADDRESS>:34008
Wed Feb 13 19:19:13 2013 us=558560 client/<IP ADDRESS>:34008 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Wed Feb 13 19:19:13 2013 us=558625 client/<IP ADDRESS>:34008 MULTI: Learn: 10.8.0.6 -> client/<IP ADDRESS>:34008
Wed Feb 13 19:19:13 2013 us=558640 client/<IP ADDRESS>:34008 MULTI: primary virtual IP for client/<IP ADDRESS>:34008: 10.8.0.6
RWed Feb 13 19:19:15 2013 us=551293 client/<IP ADDRESS>:34008 PUSH: Received control message: 'PUSH_REQUEST'
Wed Feb 13 19:19:15 2013 us=551338 client/<IP ADDRESS>:34008 send_push_reply(): safe_cap=940
Wed Feb 13 19:19:15 2013 us=551386 client/<IP ADDRESS>:34008 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
WWWWRWRRRWed Feb 13 19:19:17 2013 us=990538 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990589 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990607 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990637 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990672 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990697 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990713 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:17 2013 us=990739 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:18 2013 us=175793 client/<IP ADDRESS>:34008 MULTI: bad source address from client [::], packet dropped
RWed Feb 13 19:19:18 2013 us=175858 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:18 2013 us=175894 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:18 2013 us=377975 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:18 2013 us=378051 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:18 2013 us=658523 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:19 2013 us=157692 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:19 2013 us=362566 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:19 2013 us=362637 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:19 2013 us=362677 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:19 2013 us=581067 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:19 2013 us=781984 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RRWed Feb 13 19:19:20 2013 us=194361 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:20 2013 us=502322 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:20 2013 us=920298 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125317 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125369 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125396 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125420 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125443 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125486 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125510 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125533 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125566 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125593 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125616 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=125639 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=334310 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547654 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547708 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547751 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547782 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547807 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547822 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547841 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547869 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547898 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547924 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547946 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:21 2013 us=547971 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=182523 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=186978 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187026 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187049 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187062 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187076 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187088 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187108 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187147 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187175 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187192 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187205 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187218 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187235 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187271 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=187333 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRWed Feb 13 19:19:22 2013 us=592151 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592200 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592216 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592230 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592246 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592273 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592313 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592354 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592377 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592391 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592406 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592432 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592451 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592473 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:22 2013 us=592490 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRwRwRwRwRwRwRwRWed Feb 13 19:19:26 2013 us=168680 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwWRwRwRwRwRWed Feb 13 19:19:30 2013 us=202700 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RWed Feb 13 19:19:31 2013 us=203659 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRwRwRwRwRwRWed Feb 13 19:19:33 2013 us=201614 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRwRWed Feb 13 19:19:37 2013 us=202700 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
WRwRwRwRwRwRwRwRwRwRwRWed Feb 13 19:19:45 2013 us=204701 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRwRwWRwRwRwRwRwRwRwRwRwWRwRwRwRwRWed Feb 13 19:20:01 2013 us=211693 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRwRwRwRwRwRwRwRwRwRwRwWRwRwRwRwRwRwRwRwRwRwRwRwRwRwWRwRwRwRwRwRwRwRwRwRwRwRwWRwRwRwRwRwRwRwRWed Feb 13 19:20:33 2013 us=218444 client/<IP ADDRESS>:34008 MULTI: bad source address from client [fe80::a55e:1b12:d7ae:455d], packet dropped
RwRwRwRwWRwWed Feb 13 19:20:41 2013 us=906180 client/<IP ADDRESS>:34008 Connection reset, restarting [0]
Wed Feb 13 19:20:41 2013 us=906233 client/<IP ADDRESS>:34008 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Feb 13 19:20:41 2013 us=906434 TCP/UDP: Closing socket
Wed Feb 13 19:21:00 2013 us=977521 TCP/UDP: Closing socket
Wed Feb 13 19:21:00 2013 us=977718 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Wed Feb 13 19:21:00 2013 us=979513 Closing TUN/TAP interface
Wed Feb 13 19:21:00 2013 us=979596 /sbin/ifconfig tun0 0.0.0.0
Wed Feb 13 19:21:00 2013 us=997188 SIGTERM[hard,] received, process exiting

The only thing I've replaced are the client's IP addresses. I've just had a quick search on the internet and it suggests adding a route for the problematic address (in this case the IPv6 address for some reason).

maikcat

All clients sometimes can connect to the server, however, the Internet isn't forwarded and pinging 10.8.0.1 fails most of the time, or gives a huge latency (e.g. 3052ms)

i dont think its openvpns problem....

can you (for testing) set up a client in the SAME network with your openvpn server,
remove the push routes from server,try to connect and see if tunnel works ok...

if the above works ok then something (ISP maybe) blocks/filters traffic...(they can filter things
by using deep packet inspection)

Michael.

xmteam

How could I set this up if all I have on the server's network is the server itself (it's a VPS). It's running through a proxy at the moment so maybe that is what is blocking it, but is it normal for some packets to make it past deep packet inspection? Also, is there any way to avoid deep packet inspection?

maikcat

How could I set this up if all I have on the server's network is the server itself (it's a VPS).

in that case you cant....my bad

It's running through a proxy at the moment so maybe that is what is blocking it, but is it normal for some packets to make it past deep packet inspection? Also, is there any way to avoid deep packet inspection?

do you administer the proxy?
no there is no way you cant avoid DPI.... :cry:

Michael.

xmteam

Sadly I don't administer the VPN, although is it true that tunnelling OpenVPN itself over HTTPS would fool DPI as all it could see would be standard, encrypted HTTPS traffic which it couldn't stop?

maikcat

you cant fool dpi....

keep in mind that some proxies present their own certificates to clients
so that they can full control https sessions... :?

Michael.